CVE-2026-73099

Cross-Site Request Forgery CSRF vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an...

CVE-2026-73099

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Juneau versions through 9.2.0 . The REST server's default behavior allows the "content" query parameter to replace the request body for all HTTP methods, including GET. This enables an attacker to deliver a chosen request body via...

CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Cross-Site Request Forgery CSRF vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an...

PT-2026-137438

Name of the Vulnerable Software and Affected Versions Apache Juneau versions prior to 9.2.1 Description Cross-Site Request Forgery CSRF occurs because the REST server accepts a content query parameter that replaces the request body. This feature is enabled by default for all HTTP methods, includi...

CVE-2026-23847 SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons type=8. The content query parameter is inserted directly into the S...

CVE-2026-23847: Improper Neutralization of Input During Web Page Generation

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons type=8. The content query parameter is inserted directly into the S...